Preventing Reflective DLL Injection on UWP Apps Mojtaba Zaheri1, Salman Niksefat2, and Babak Sadeghiyan3 1,2,3APA Research Center, Amirkabir University of Technology Abstract - Universal Windows Platform (UWP) is the Microsoft’s recent platform-homogeneous application architecture. It al-lows a code to run on variety of devices including PC, mobile devices, etc., without needing to be rewritten or recompiled. UWP apps are becoming more and more popular and consequently this new application platform is becoming the next attack target for hackers and malware developers. In this paper, we first study the issue of host-based code injection attacks (HBCIA) in UWP apps. We show that de-spite the embedded mechanisms in UWP to maintain code integrity and to only allow legitimate DLLs to be loaded in memory, it is still possible to circumvent the defensive mechanisms and launch a variant of HBCIA called Reflective DLL Injection on UWP apps. We then propose a novel defence mechanism against reflective DLL injection attacks on UWP apps. Our proposed method can detect malicious/benign injection attempts on UWP apps and prevents malicious injections while allowing the benign injections to proceed as normal. Our experiments show that the proposed defence has less than 1% impact on system’s overall performance and can be used inside anti-virus (AV) products to strengthen their protection capabilities. KEYWORDS – DLL Injection, Universal Windows Platform, UWP I. INTRODUCTION executing the code [1]. A recent research in [1] shows that near 64% of the total of 162850 Universal Windows Platform (UWP), first sample malware use HBCIA as part of their introduced in Windows 10, is the Microsoft’s malicious behaviour. platform homogeneous application One strong motivation for using HBCIA by architecture. Its purpose is to allow malware is to evade detection and bypass development of universal applications that run host-based firewalls: Mal-ware usually on a variety of platforms including PC, mobile connect to their C&C 1 servers for sending in- devices, and IoT devices. This relieves the formation and receiving new commands. code from the need to be rewritten or Thus host-based firewalls are generally recompiled for each platform. Similar to sensitive to outgoing connections of locally Android and IOS, this platform has its own running applications and they have rules to proprietary software store through which prevent unknown applications from accessing Microsoft can have more control over the the network. To prevent being caught by the distributed UWP applications. Since its firewalls, new malware generally uses smart release, Microsoft has encouraged the techniques for connecting to the Internet. One software developers to write code in UWP such technique is taking advantage of and the company itself included some UWP HBCIAs, i.e., injecting a software module to applications in Windows 10, including another legitimate running process such as Microsoft Edge browser and Microsoft Mozilla Firefox, Internet Explorer or Google Groove Music. Chrome and communicating using the With rapid popularity of UWP applications injected module. Among these browsers, among soft-ware developers and considering Microsoft Internet Explorer has been more the strong support of Microsoft, UWP apps promising for hackers as it is generally are becoming more and more popular among available in Windows family of operating end users and consequently this new platform systems by default. Moreover, Microsoft- has become the next attack target for hackers Edge, the Microsoft’s new UWP-based and malware developers. One important browser introduced in Windows 10, can be the category of intra-host attacks that can next injection target for malware that are potentially target UWP applications is Host willing to launch a code-injection attack. Based Code Injection Attacks (HBCIA). In this paper, we demonstrate that it is still HBCIA is defined as locally copying a code possible to launch successful DLL injection from a malicious source process into the attacks by a technique called reflective DLL address space of a target process and injection [2][3] despite the new security 41 OIC-CERT Journal of Cyber Security (2018) 1.1:41-52 ISSN 2636-9680 Print Preventing Reflective DLL Injection on UWP Apps mechanisms embedded in UWP framework to countermeasures. In section III, we review the maintain code integrity and prevent un- security mechanisms embedded in UWP apps signed/malicious DLL injections. Then, we that are related to HBCIA attacks. In section propose a defence mechanism against such IV, we demonstrate the methods that can attacks on UWP apps. circumvent the integrity mechanisms of UWP Some currently published methods such as and perform the reflective DLL injection [4][5] try to parse the victim process memory attack in UWP frame-work. In section V, we and find if a malicious DLL is loaded into the present our defensive mechanism to reflective process memory. Then, they try to remove it DLL injection attacks. In section VI, we and clean the memory. How-ever, it’s not a present the results of the evaluation of the sound and complete countermeasure, as the proposed system. Finally, section VII malware is already loaded in the memory and concludes the paper. can do its malicious activities before being removed from the memory. In contrast, in our proposed mitigation, we try to prevent the II. RELATED WORK malware to load the malicious DLL from the very beginning. Another challenge in The works in host-based code injection countering such attacks is that not all code attacks can be classified into methods for injections are malicious. The operating system performing such attacks, and mechanisms for may inject some legitimate DLLs into detection and prevention. In this section, we processes. Moreover, processes may inject review these works and considering the code into their own address space for detection and prevention mechanisms, we purposes like loading plug-ins, etc. Therefore, claim that none of them is suitable for we need a method to distinguish between defending against reflective DLL injection on malicious and benign injections. Our proposed UWP apps. defence mechanism does this with high precision. In case of a malicious injection, it A. Performing HBCIA successfully prevents the DLL to be written into the target process and raises an alarm. On Since these methods have rather a technical the other hand, in case of a benign injection, nature, the concept has received much more the injection proceeds as normal. Finally, by attention in the technical forums rather than taking advantage of PCMark benchmarking the research papers. tool, we show that our proposed technique In [1], the authors have presented a semi- imposes a little overhead on operating system. formal definition for host-based code injection To summarize, our contribution in this attacks that we cited in the introduction. The paper is a mitigation technique against paper has presented the basic idea of the reflective DLL injection on UWP apps that technique in three main steps including I) provides the following original advantages: Victim process selection, II) Code copying, i. It entirely prevents a malware from and III) Code execution. This paper also loading its malicious module into the mentions several motivations behind using target process memory. HBCIAs including interception of critical ii. The proposed mechanism is very information, privilege escalation, and efficient as it only monitors and detection avoidance. modifies the behaviour of one API In [6], a classification on various DLL (NtWriteVirtualMemory), which Injection techniques is presented. This paper leads to a very low overhead on the system performance. classifies these techniques as follows: iii. It doesn’t have any effects on normal CreateRemoteThread [7], Creating a Proxy DLL injections, as it’s possible to DLL [8], Modification of Windows Registry load legitimate/signed DLLs into [9], Windows Hooks [10][11], Using a target UWP apps through calling the Debugger [12], Patching the IAT [13] and LoadLibrary API. Reflective Injection [2][14]. This paper is organized as follows: In Most of the above techniques can’t be used section II, we re-view related work including to inject into UWP apps because the HBCIA methods and the existing LoadLibrary API has been limited by UWP 42 OIC-CERT Journal of Cyber Security Preventing Reflective DLL Injection on UWP Apps framework code integrity mechanism. process, it interrupts the process and loads a However, a specific type of DLL Injection monitoring module that later checks the API called Reflective Injection which was call patterns in the target process to see if its behavior is malicious. However, the proposed introduced in [2] can be used to circumvent method is only effective against Trojan this mechanism. This method can load a DLL downloaders. on UWP apps through the concept of Also, Detecting the Code Injection Engine reflective programming without directly using (DCIE) [19] tries to reject all the suspicious LoadLibrary API. In section 4, further details thread creating calls by hooking APIs and about this technique is presented. tracing three main steps of code injection attacks: allocating memory, writing to the memory, and creating the thread. Although B. Detecting and Preventing HBCIA this method prevents the injection attacks, it Since the HBCIAs need to have local has two major weaknesses; access to the tar-get system, these types of attacks had not been considered very i. It rules out injection of legitimate and hazardous in the past. However, the advances signed DLLs, and in HB-CIA techniques and ever-increasing ii. It hooks three APIs, which decreases number of malwares in recent years have system’s performance. motivated the security researchers to work on In case of reflective injection, the articles mitigation mechanisms for these attacks. In [20][21] propose ideas to check the memory the following, we review some of these of running processes periodically and search methods.